51–60 of 90 posts
Earlier quoted context omitted.
I wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/
I would indeed not trust any OS that allows you to erase the root filesystem without at least asking for the superuser password :)
:-)
I hate the web
How is this "browser vulnerability" different from a bookmarklet?
Earlier quoted context omitted.
In the snippet posted by tshadwell. The code outputs a string into the console via console.log(), then executes the snippet from the console via eval(). Presumably to avoid to avoid Facebook's protections against console copy\paste execution. Edit: I'm wrong. Need some sleep.
tshadwell did not post a code snippet he wrote. He posted a link to a site that demonstrates the sandbox that Facebook uses (I believe the Facebook engineer that wrote the Facebook implementation also owns escape.alf.nu). This code does not break out of the sandbox, it creates it.
Wouldn't it be just as simple for an attacker to persuade a victim to paste a string starting with "javascript:" into the URL bar?
Earlier quoted context omitted.
I thought it was obfuscated variable names, but it's a turkish word https://en.wiktionary.org/wiki/arkada%C5%9Flar (follower)
It means "friends". There are some functions named "get messages", "get friends", "get a random friend" and "post comment" too. Weird.
Earlier quoted context omitted.
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
If scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!". This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (ev…
Never seen it called "dancing monkeys" - got a cite?
Earlier quoted context omitted.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
Something something security by obscurity something something.
I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
javascript:alert('hi ' + document.body.innerHTML);